The Daily Index — Friday, June 27, 2025

GENERAL

TLDR InfoSec

Access Management Summit 2025

Summary unavailable

gartner.com

TLDR InfoSec

HACKERS TURN SCREENCONNECT INTO MALWARE USING AUTHENTICODE STUFFING

Cybersecurity firm G DATA is warning users of ConnectWise's ScreenConnect remote monitoring and management (RMM) software about a new malware campaign that utilizes ScreenConnect installers with a malicious configuration embedded in the authenticode certificate. The malicious installer is configured to have the title “Windows Update,” change the background to a Windows Update image, and connect to an attacker-controlled server. ConnectWise has revoked the certificates used in these binaries.

bleepingcomputer.com · 2 min

TLDR InfoSec

GLASGOW COUNCIL SERVICES REMAIN OFFLINE A WEEK AFTER CYBER ATTACK

Glasgow City Council suffered a cyberattack on June 19 via IT supplier CGI's third-party servers, disrupting online services including planning applications, payments, and pension portals. Customer data may have been stolen, but the confirmation has not yet been made.

computerweekly.com · 2 min

TLDR InfoSec

CYBERCRIMINALS ABUSE OPEN-SOURCE TOOLS TO TARGET AFRICA'S FINANCIAL SECTOR

Threat actor CL-CRI-1014 has been targeting African financial institutions since July 2023. The attackers use open-source tools (PoshC2, Chisel, and Classroom Spy) and forge file signatures to establish network access. The group operates as initial access brokers, selling compromised financial institution access on darknet markets.

unit42.paloaltonetworks.com · 7 min

TLDR InfoSec

MARKETPLACE TAKEOVER: HOW WE COULD'VE TAKEN OVER EVERY DEVELOPER USING A VSCODE FORK; PUTTING MILLIONS AT RISK

Security researchers have discovered a critical vulnerability in open-vsx.org, the open-source VS Code extensions marketplace used by over 8 million developers across popular editors such as Cursor, Windsurf, and VSCodium. The flaw allowed attackers to steal admin credentials through a CI pipeline issue, enabling them to publish malicious updates to every extension on the marketplace and potentially compromise millions of developer machines. The vulnerability was responsibly disclosed in May and patched after multiple iterations over several weeks.

blog.koi.security · 7 min

TLDR InfoSec

5 YEARS, 160 COMMENTS, AND THE VULNERABILITY THAT REFUSED TO DIE

Jonathan Leitschuh discovered an old vulnerability in SnakeYAML that could enable remote code execution through unsafe deserialization. The maintainer initially closed the report as “Won't Fix,” claiming a safe constructor made the code safe. After a lengthy discussion, PoCs, data, and a nearly hour-long call, Leitschuh convinced the maintainer to use the secure constructor by default and make insecure behavior opt-in, marking a win for secure defaults in SnakeYAML 2.0.

links.tldrnewsletter.com · 8 min

TLDR InfoSec

EXCLUSIVE FOR TLDR READERS: GET 40% OFF FOR A (VERY) LIMITED TIME.

Summary unavailable

account.proton.me

TLDR InfoSec

BONFY (PRODUCT LAUNCH)

Bonfy provides AI governance solutions that detect and prevent risks in enterprise content, ensuring secure and compliant use of generative AI across organizations.

bonfy.ai

TLDR InfoSec

YARA-X IS STABLE

The YARA team has officially announced the first stable release of YARA-X and moved the original YARA project into maintenance mode.

virustotal.github.io · 2 min

TLDR InfoSec

IRANIAN HACKERS ARE TRYING TO CREATE A PSYCHOLOGICAL WAR IN CYBERSPACE

A new report by cybersecurity agency DomainTools alleges that the Iranian-backed CyberAv3ngers group is shifting its operations to focus on misinformation and psychological warfare. The CyberAv3ngers have been active since 2023, and while they have been tied to confirmed intrusions, they have also claimed targets that have been debunked. According to the report, the group has refined cyber activity “into a fully realized propaganda apparatus” with the goal of not just breaching systems but “to control the narrative surrounding those breaches.”

nextgov.com · 2 min

TLDR InfoSec

QILIN RANSOMWARE ATTACK ON NHS SUPPLIER CONTRIBUTED TO PATIENT FATALITY

The NHS confirmed a patient died following Qilin's ransomware attack on pathology provider Synnovis. A delayed blood test result due to disrupted services contributed to the death. The attack affected multiple London NHS trusts, harming 170 patients in total. This represents a rare confirmed link between ransomware and patient mortality.

theregister.com · 4 min

TLDR InfoSec

WINDOWS KILLED THE BLUE SCREEN OF DEATH

Microsoft is replacing Windows' iconic Blue Screen of Death with a Black Screen of Death nearly 40 years after its introduction. The change is part of the Windows Resiliency Initiative following the CrowdStrike outage that affected 8.5 million devices. Microsoft calls it a "simplified UI" but hasn't acknowledged the significance of ending this computing era.

techcrunch.com · 2 min

TLDR InfoSec

EX-STUDENT CHARGED OVER HACKING UNIVERSITY FOR CHEAP PARKING, DATA BREACHES

Birdie Kingston, a 27-year-old former Western Sydney University student, was arrested for hacking the university since 2021, stealing over 100GB of data, altering academic records, and demanding $40,000 in cryptocurrency ransom.

bleepingcomputer.com · 2 min

TLDR InfoSec

MICROSOFT CONFIRMS FAMILY SAFETY BLOCKS GOOGLE CHROME FROM LAUNCHING

Microsoft Family Safety has a bug that temporarily prevents some Windows devices from opening browsers like Google Chrome after updates, with Microsoft recommending enabling 'Activity reporting' as a workaround until a fix is released.

bleepingcomputer.com · 2 min

TLDR InfoSec

MAN WHO HACKED ORGANIZATIONS TO ADVERTISE SECURITY SERVICES PLEADS GUILTY

Nicholas Kloster, a Kansas City man, admitted to hacking multiple organizations to promote his cybersecurity services and faces up to five years in prison and a $250,000 fine.

securityweek.com · 2 min